We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is already blocking the attack.
At the same time, what is the risk of an IP being reused multiple times with different attacks? (and the possibility that one of these attacks from the same IP isn't known to the NIPS)
I'm mostly talking about incoming traffic from outside.